studio/sbbb
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: bring up local dev stack — all services running

Browse Source 
- Ory Hydra + Kratos: fixed secret management, DSN config, DB migrations,
  OAuth2Client CRD (helm template skips crds/ dir), login-ui env vars
- SeaweedFS: added s3.json credentials file via -s3.config CLI flag
- OpenBao: standalone mode with auto-unseal sidecar, keys in K8s secret
- OpenSearch: increased memory to 1.5Gi / JVM 1g heap
- Gitea: SSL_MODE disable, S3 bucket creation fixed
- Hive: automountServiceAccountToken: false (Lima virtiofs read-only rootfs quirk)
- LiveKit: API keys in values, hostPort conflict resolved
- Linkerd: native sidecar (proxy.nativeSidecar=true) to avoid blocking Jobs
- All placeholder images replaced: pingora→nginx:alpine, login-ui→oryd/kratos-selfservice-ui-node

Full stack running: postgres, valkey, openbao, opensearch, seaweedfs,
kratos, hydra, gitea, livekit, hive (placeholder), login-ui
This commit is contained in:
Sienna Meridian Satterwhite
2026-02-28 22:08:38 +00:00
parent 92e80a761c
commit a589e6280d
19 changed files with 852 additions and 103 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
base/data/kustomization.yaml
View File

@@ -10,12 +10,20 @@ resources:
- valkey-service.yaml
- opensearch-deployment.yaml
- opensearch-service.yaml
- openbao-keys-placeholder.yaml
helmCharts:
# helm repo add cnpg https://cloudnative-pg.github.io/charts
# releaseName=cloudnative-pg matches chart name → operator Deployment is named `cloudnative-pg`
- name: cloudnative-pg
repo: https://cloudnative-pg.github.io/charts
version: "0.27.1"
releaseName: cloudnative-pg
namespace: data
# helm repo add openbao https://openbao.github.io/openbao-helm
- name: openbao
repo: https://openbao.github.io/openbao-helm
version: "0.25.6"
releaseName: openbao
namespace: data
valuesFile: openbao-values.yaml

9
base/data/openbao-keys-placeholder.yaml Normal file
View File

@@ -0,0 +1,9 @@
# Placeholder secret — replaced by the init script after `bao operator init`.
# Exists so the auto-unseal sidecar's volume mount doesn't block pod startup.
apiVersion: v1
kind: Secret
metadata:
name: openbao-keys
namespace: data
type: Opaque
data: {}

78
base/data/openbao-values.yaml Normal file
View File

@@ -0,0 +1,78 @@
# OpenBao Helm values — standalone single-instance mode.
# Root token + unseal key stored in K8s secret `openbao-keys` (created by init script).
global:
tlsDisable: true
injector:
enabled: true
agentDefaults:
cpuLimit: "250m"
cpuRequest: "50m"
memLimit: "64Mi"
memRequest: "32Mi"
server:
image:
registry: quay.io
repository: openbao/openbao
standalone:
enabled: true
config: |
ui = true
listener "tcp" {
tls_disable = 1
address = "[::]:8200"
}
storage "file" {
path = "/openbao/data"
}
dataStorage:
enabled: true
size: 1Gi
resources:
limits:
memory: 128Mi
requests:
memory: 64Mi
cpu: 50m
# Auto-unseal sidecar: reads unseal key from K8s secret and unseals on restart.
extraContainers:
- name: auto-unseal
image: quay.io/openbao/openbao
command: ["/bin/sh", "-c"]
args:
- |
export BAO_ADDR=http://127.0.0.1:8200
echo "auto-unseal: waiting for openbao to start..."
until bao status -format=json 2>/dev/null; do sleep 2; done
while true; do
if [ -f /openbao/unseal/key ]; then
SEALED=$(bao status -format=json 2>/dev/null | grep '"sealed"' | grep -c 'true')
if [ "$SEALED" = "1" ]; then
echo "auto-unseal: unsealing..."
bao operator unseal "$(cat /openbao/unseal/key)"
fi
fi
sleep 15
done
volumeMounts:
- name: userconfig-openbao-keys
mountPath: /openbao/unseal
readOnly: true
resources:
limits:
memory: 32Mi
requests:
memory: 16Mi
cpu: 10m
extraVolumes:
- type: secret
name: openbao-keys
path: openbao-unseal
optional: true

6
base/data/opensearch-deployment.yaml
View File

@@ -33,12 +33,12 @@ spec:
- name: discovery.type
value: single-node
- name: OPENSEARCH_JAVA_OPTS
value: "-Xms256m -Xmx512m"
value: "-Xms512m -Xmx1g"
- name: DISABLE_SECURITY_PLUGIN
value: "true"
resources:
limits:
memory: 512Mi
memory: 1500Mi
requests:
memory: 256Mi
memory: 768Mi
cpu: 100m

23
base/data/postgres-cluster.yaml
View File

@@ -19,26 +19,27 @@ spec:
secret:
name: postgres-superuser
postInitSQL:
# Create all 10 logical databases and their owners
- CREATE USER kratos;
# Create all 10 logical databases and their owners.
# Passwords are set by the seed-secrets script via ALTER USER after init.
- CREATE USER kratos WITH LOGIN;
- CREATE DATABASE kratos_db OWNER kratos;
- CREATE USER hydra;
- CREATE USER hydra WITH LOGIN;
- CREATE DATABASE hydra_db OWNER hydra;
- CREATE USER docs;
- CREATE USER docs WITH LOGIN;
- CREATE DATABASE docs_db OWNER docs;
- CREATE USER meet;
- CREATE USER meet WITH LOGIN;
- CREATE DATABASE meet_db OWNER meet;
- CREATE USER drive;
- CREATE USER drive WITH LOGIN;
- CREATE DATABASE drive_db OWNER drive;
- CREATE USER messages;
- CREATE USER messages WITH LOGIN;
- CREATE DATABASE messages_db OWNER messages;
- CREATE USER conversations;
- CREATE USER conversations WITH LOGIN;
- CREATE DATABASE conversations_db OWNER conversations;
- CREATE USER people;
- CREATE USER people WITH LOGIN;
- CREATE DATABASE people_db OWNER people;
- CREATE USER gitea;
- CREATE USER gitea WITH LOGIN;
- CREATE DATABASE gitea_db OWNER gitea;
- CREATE USER hive;
- CREATE USER hive WITH LOGIN;
- CREATE DATABASE hive_db OWNER hive;
storage:

9
base/devtools/gitea-values.yaml
View File

@@ -21,10 +21,11 @@ gitea:
LFS_START_SERVER: "true"
database:
DB_TYPE: postgres
HOST: postgres-rw.data.svc.cluster.local:5432
NAME: gitea_db
USER: gitea
DB_TYPE: postgres
HOST: postgres-rw.data.svc.cluster.local:5432
NAME: gitea_db
USER: gitea
SSL_MODE: disable
# PASSWD injected via additionalConfigFromEnvs below
cache:

2
base/ingress/pingora-deployment.yaml
View File

@@ -18,7 +18,7 @@ spec:
spec:
containers:
- name: pingora
image: ghcr.io/sunbeam-studio/pingora:latest
image: nginx:alpine # placeholder until custom Pingora image is built
ports:
- name: http
containerPort: 80

3
base/lasuite/hive-deployment.yaml
View File

@@ -13,9 +13,10 @@ spec:
labels:
app: hive
spec:
automountServiceAccountToken: false
containers:
- name: hive
image: ghcr.io/sunbeam-studio/hive:latest
image: nginx:alpine # placeholder until La Suite Hive image is built
volumeMounts:
- name: config
mountPath: /etc/hive

7
base/media/livekit-values.yaml
View File

@@ -24,9 +24,10 @@ livekit:
# Valkey is protocol-compatible with Redis; LiveKit sees this as a Redis endpoint
address: valkey.data.svc.cluster.local:6379
# API keys are loaded from a Kubernetes Secret and mounted as env vars.
# keys:
# <key>: <secret> # set in overlay Secret, not here
# API keys — overridden per-environment via secrets.
# At least one key must be present for the server to start.
keys:
devkey: secret-placeholder
deployment:
resources:

376
base/ory/hydra-oauth2client-crd.yaml Normal file
View File

@@ -0,0 +1,376 @@
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.19.0
name: oauth2clients.hydra.ory.sh
spec:
group: hydra.ory.sh
names:
kind: OAuth2Client
listKind: OAuth2ClientList
plural: oauth2clients
singular: oauth2client
scope: Namespaced
versions:
- name: v1alpha1
schema:
openAPIV3Schema:
description: OAuth2Client is the Schema for the oauth2clients API
properties:
apiVersion:
description: |-
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
type: string
kind:
description: |-
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
type: string
metadata:
type: object
spec:
description:
OAuth2ClientSpec defines the desired state of OAuth2Client
properties:
allowedCorsOrigins:
description:
AllowedCorsOrigins is an array of allowed CORS origins
items:
description:
RedirectURI represents a redirect URI for the client
pattern: \w+:/?/?[^\s]+
type: string
type: array
audience:
description:
Audience is a whitelist defining the audiences this client
is allowed to request tokens for
items:
type: string
type: array
backChannelLogoutSessionRequired:
default: false
description:
BackChannelLogoutSessionRequired Boolean value specifying
whether the RP requires that a sid (session ID) Claim be
included in the Logout Token to identify the RP session with
the OP when the backchannel_logout_uri is used. If omitted,
the default value is false.
type: boolean
backChannelLogoutURI:
description:
BackChannelLogoutURI RP URL that will cause the RP to log
itself out when sent a Logout Token by the OP
pattern: (^$|^https?://.*)
type: string
clientName:
description:
ClientName is the human-readable string name of the client
to be presented to the end-user during authorization.
type: string
deletionPolicy:
description: |-
Indicates if a deleted OAuth2Client custom resource should delete the database row or not.
Values can be 'delete' to delete the OAuth2 client, value 'orphan' to keep an orphan oauth2 client.
enum:
- delete
- orphan
type: string
frontChannelLogoutSessionRequired:
default: false
description:
FrontChannelLogoutSessionRequired Boolean value specifying
whether the RP requires that iss (issuer) and sid (session
ID) query parameters be included to identify the RP session
with the OP when the frontchannel_logout_uri is used
type: boolean
frontChannelLogoutURI:
description:
FrontChannelLogoutURI RP URL that will cause the RP to log
itself out when rendered in an iframe by the OP. An iss
(issuer) query parameter and a sid (session ID) query
parameter MAY be included by the OP to enable the RP to
validate the request and to determine which of the
potentially multiple sessions is to be logged out; if either
is included, both MUST be
pattern: (^$|^https?://.*)
type: string
grantTypes:
description:
GrantTypes is an array of grant types the client is allowed
to use.
items:
description: GrantType represents an OAuth 2.0 grant type
enum:
- client_credentials
- authorization_code
- implicit
- refresh_token
type: string
maxItems: 4
minItems: 1
type: array
hydraAdmin:
description: |-
HydraAdmin is the optional configuration to use for managing
this client
properties:
endpoint:
description: |-
Endpoint is the endpoint for the hydra instance on which
to set up the client. This value will override the value
provided to `--endpoint` (defaults to `"/clients"` in the
application)
pattern: (^$|^/.*)
type: string
forwardedProto:
description: |-
ForwardedProto overrides the `--forwarded-proto` flag. The
value "off" will force this to be off even if
`--forwarded-proto` is specified
pattern: (^$|https?|off)
type: string
port:
description: |-
Port is the port for the hydra instance on
which to set up the client. This value will override the value
provided to `--hydra-port`
maximum: 65535
type: integer
url:
description: |-
URL is the URL for the hydra instance on
which to set up the client. This value will override the value
provided to `--hydra-url`
maxLength: 256
pattern: (^$|^https?://.*)
type: string
type: object
jwksUri:
description:
JwksUri Define the URL where the JSON Web Key Set should be
fetched from when performing the private_key_jwt client
authentication method.
pattern: (^$|^https?://.*)
type: string
metadata:
description: Metadata is arbitrary data
nullable: true
type: object
x-kubernetes-preserve-unknown-fields: true
postLogoutRedirectUris:
description:
PostLogoutRedirectURIs is an array of the post logout
redirect URIs allowed for the application
items:
description:
RedirectURI represents a redirect URI for the client
pattern: \w+:/?/?[^\s]+
type: string
type: array
redirectUris:
description:
RedirectURIs is an array of the redirect URIs allowed for
the application
items:
description:
RedirectURI represents a redirect URI for the client
pattern: \w+:/?/?[^\s]+
type: string
type: array
responseTypes:
description: |-
ResponseTypes is an array of the OAuth 2.0 response type strings that the client can
use at the authorization endpoint.
items:
description:
ResponseType represents an OAuth 2.0 response type strings
enum:
- id_token
- code
- token
- code token
- code id_token
- id_token token
- code id_token token
type: string
maxItems: 3
minItems: 1
type: array
scope:
description: |-
Scope is a string containing a space-separated list of scope values (as
described in Section 3.3 of OAuth 2.0 [RFC6749]) that the client
can use when requesting access tokens.
Use scopeArray instead.
pattern: ([a-zA-Z0-9\.\*]+\s?)*
type: string
scopeArray:
description: |-
Scope is an array of scope values (as described in Section 3.3 of OAuth 2.0 [RFC6749])
that the client can use when requesting access tokens.
items:
type: string
type: array
secretName:
description:
SecretName points to the K8s secret that contains this
client's ID and password
maxLength: 253
minLength: 1
pattern: '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*'
type: string
skipConsent:
default: false
description:
SkipConsent skips the consent screen for this client.
type: boolean
tokenEndpointAuthMethod:
allOf:
- enum:
- client_secret_basic
- client_secret_post
- private_key_jwt
- none
- enum:
- client_secret_basic
- client_secret_post
- private_key_jwt
- none
description:
Indication which authentication method should be used for
the token endpoint
type: string
tokenLifespans:
description: |-
TokenLifespans is the configuration to use for managing different token lifespans
depending on the used grant type.
properties:
authorization_code_grant_access_token_lifespan:
description: |-
AuthorizationCodeGrantAccessTokenLifespan is the access token lifespan
issued on an authorization_code grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)"
type: string
authorization_code_grant_id_token_lifespan:
description: |-
AuthorizationCodeGrantIdTokenLifespan is the id token lifespan
issued on an authorization_code grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)"
type: string
authorization_code_grant_refresh_token_lifespan:
description: |-
AuthorizationCodeGrantRefreshTokenLifespan is the refresh token lifespan
issued on an authorization_code grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)"
type: string
client_credentials_grant_access_token_lifespan:
description: |-
AuthorizationCodeGrantRefreshTokenLifespan is the access token lifespan
issued on a client_credentials grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)"
type: string
implicit_grant_access_token_lifespan:
description: |-
ImplicitGrantAccessTokenLifespan is the access token lifespan
issued on an implicit grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)"
type: string
implicit_grant_id_token_lifespan:
description: |-
ImplicitGrantIdTokenLifespan is the id token lifespan
issued on an implicit grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)"
type: string
jwt_bearer_grant_access_token_lifespan:
description: |-
JwtBearerGrantAccessTokenLifespan is the access token lifespan
issued on a jwt_bearer grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)"
type: string
refresh_token_grant_access_token_lifespan:
description: |-
RefreshTokenGrantAccessTokenLifespan is the access token lifespan
issued on a refresh_token grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)"
type: string
refresh_token_grant_id_token_lifespan:
description: |-
RefreshTokenGrantIdTokenLifespan is the id token lifespan
issued on a refresh_token grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)"
type: string
refresh_token_grant_refresh_token_lifespan:
description: |-
RefreshTokenGrantRefreshTokenLifespan is the refresh token lifespan
issued on a refresh_token grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)"
type: string
type: object
logoUri:
type: string
description: LogoURI is the URL for the client's logo
pattern: (^$|^https?://.*)
required:
- grantTypes
- secretName
type: object
status:
description:
OAuth2ClientStatus defines the observed state of OAuth2Client
properties:
conditions:
items:
description:
OAuth2ClientCondition contains condition information for
an OAuth2Client
properties:
status:
enum:
- "True"
- "False"
- Unknown
type: string
type:
type: string
required:
- status
- type
type: object
type: array
observedGeneration:
description:
ObservedGeneration represents the most recent generation
observed by the daemon set controller.
format: int64
type: integer
reconciliationError:
description:
ReconciliationError represents an error that occurred during
the reconciliation process
properties:
description:
description:
Description is the description of the reconciliation
error
type: string
statusCode:
description:
Code is the status code of the reconciliation error
type: string
type: object
type: object
type: object
served: true
storage: true
subresources:
status: {}

28
base/ory/hydra-values.yaml
View File

@@ -1,11 +1,13 @@
# Base Ory Hydra Helm values.
# DOMAIN_SUFFIX is replaced by overlay patches.
# DSN and system secrets come from the overlay-specific Secret.
# DOMAIN_SUFFIX is replaced at apply time via sed.
# secret.enabled: false — we create the "hydra" K8s Secret via seed script.
# DSN is set in config (chart strips it from env, so must be in values).
hydra:
automigration:
enabled: true
config:
dsn: "postgresql://hydra:$(HYDRA_DB_PASSWORD)@postgres-rw.data.svc.cluster.local:5432/hydra_db"
dsn: "postgresql://hydra:localdev@postgres-rw.data.svc.cluster.local:5432/hydra_db?sslmode=disable"
urls:
self:
issuer: https://auth.DOMAIN_SUFFIX/
@@ -14,19 +16,6 @@ hydra:
logout: https://auth.DOMAIN_SUFFIX/logout
error: https://auth.DOMAIN_SUFFIX/error
secrets:
system:
- $(HYDRA_SYSTEM_SECRET)
cookie:
- $(HYDRA_COOKIE_SECRET)
oidc:
subject_identifiers:
supported_types:
- public
pairwise:
salt: $(HYDRA_PAIRWISE_SALT)
serve:
cookies:
same_site_mode: Lax
@@ -36,6 +25,11 @@ hydra:
allowed_origins:
- https://*.DOMAIN_SUFFIX
# Disable chart's secret generation — we create the "hydra" secret via seed script
# with keys: secretsSystem, secretsCookie, pairwise-salt.
secret:
enabled: false
deployment:
resources:
limits:

19
base/ory/kratos-values.yaml
View File

@@ -1,12 +1,13 @@
# Base Ory Kratos Helm values.
# DOMAIN_SUFFIX is replaced by overlay patches (sunbeam.pt / <LIMA_IP>.sslip.io).
# DSN and SMTP credentials come from the overlay-specific Secret.
# DOMAIN_SUFFIX is replaced at apply time via sed.
# DSN is set in config (chart renders it into kratos-secrets Secret automatically).
kratos:
automigration:
enabled: true
config:
version: v0.13.0
dsn: "postgresql://kratos:$(KRATOS_DB_PASSWORD)@postgres-rw.data.svc.cluster.local:5432/kratos_db"
dsn: "postgresql://kratos:localdev@postgres-rw.data.svc.cluster.local:5432/kratos_db?sslmode=disable"
selfservice:
default_browser_return_url: https://auth.DOMAIN_SUFFIX/
@@ -24,6 +25,7 @@ kratos:
ui_url: https://auth.DOMAIN_SUFFIX/login
registration:
ui_url: https://auth.DOMAIN_SUFFIX/registration
enabled: true
recovery:
ui_url: https://auth.DOMAIN_SUFFIX/recovery
settings:
@@ -33,11 +35,11 @@ kratos:
default_schema_id: default
schemas:
- id: default
url: file:///etc/config/kratos/identity.schema.json
url: base64://ewogICIkaWQiOiAiaHR0cHM6Ly9zY2hlbWFzLnN1bmJlYW0uc3R1ZGlvL2lkZW50aXR5Lmpzb24iLAogICIkc2NoZW1hIjogImh0dHA6Ly9qc29uLXNjaGVtYS5vcmcvZHJhZnQtMDcvc2NoZW1hIyIsCiAgInR5cGUiOiAib2JqZWN0IiwKICAidGl0bGUiOiAiUGVyc29uIiwKICAicHJvcGVydGllcyI6IHsKICAgICJ0cmFpdHMiOiB7CiAgICAgICJ0eXBlIjogIm9iamVjdCIsCiAgICAgICJwcm9wZXJ0aWVzIjogewogICAgICAgICJlbWFpbCI6IHsKICAgICAgICAgICJ0eXBlIjogInN0cmluZyIsCiAgICAgICAgICAiZm9ybWF0IjogImVtYWlsIiwKICAgICAgICAgICJ0aXRsZSI6ICJFbWFpbCIsCiAgICAgICAgICAib3J5LnNoL2tyYXRvcyI6IHsKICAgICAgICAgICAgImNyZWRlbnRpYWxzIjogewogICAgICAgICAgICAgICJwYXNzd29yZCI6IHsKICAgICAgICAgICAgICAgICJpZGVudGlmaWVyIjogdHJ1ZQogICAgICAgICAgICAgIH0KICAgICAgICAgICAgfSwKICAgICAgICAgICAgInJlY292ZXJ5IjogewogICAgICAgICAgICAgICJ2aWEiOiAiZW1haWwiCiAgICAgICAgICAgIH0sCiAgICAgICAgICAgICJ2ZXJpZmljYXRpb24iOiB7CiAgICAgICAgICAgICAgInZpYSI6ICJlbWFpbCIKICAgICAgICAgICAgfQogICAgICAgICAgfQogICAgICAgIH0sCiAgICAgICAgIm5hbWUiOiB7CiAgICAgICAgICAidHlwZSI6ICJvYmplY3QiLAogICAgICAgICAgInByb3BlcnRpZXMiOiB7CiAgICAgICAgICAgICJmaXJzdCI6IHsgInR5cGUiOiAic3RyaW5nIiwgInRpdGxlIjogIkZpcnN0IG5hbWUiIH0sCiAgICAgICAgICAgICJsYXN0IjogeyAidHlwZSI6ICJzdHJpbmciLCAidGl0bGUiOiAiTGFzdCBuYW1lIiB9CiAgICAgICAgICB9CiAgICAgICAgfQogICAgICB9LAogICAgICAicmVxdWlyZWQiOiBbImVtYWlsIl0KICAgIH0KICB9Cn0K
courier:
smtp:
connection_uri: "smtp://$(SMTP_USER):$(SMTP_PASSWORD)@localhost:25/"
connection_uri: "smtp://local:local@localhost:25/"
from_address: no-reply@DOMAIN_SUFFIX
from_name: Sunbeam
@@ -51,6 +53,11 @@ kratos:
admin:
base_url: http://kratos-admin.ory.svc.cluster.local:4434/
# Chart creates kratos-secrets from Helm values (dsn + generated random secrets).
secret:
enabled: true
nameOverride: kratos-secrets
deployment:
resources:
limits:

2
base/ory/kustomization.yaml
View File

@@ -6,6 +6,8 @@ namespace: ory
resources:
- namespace.yaml
- login-ui-deployment.yaml
# Hydra chart CRDs are not rendered by helm template; apply manually.
- hydra-oauth2client-crd.yaml
# The hydra-maester sub-chart does not set .Release.Namespace in its Deployment template.
patches:

14
base/ory/login-ui-deployment.yaml
View File

@@ -15,7 +15,7 @@ spec:
spec:
containers:
- name: login-ui
image: ghcr.io/sunbeam-studio/login-ui:latest
image: oryd/kratos-selfservice-ui-node:v1.3.0
ports:
- name: http
containerPort: 3000
@@ -23,15 +23,23 @@ spec:
env:
- name: KRATOS_PUBLIC_URL
value: "http://kratos-public.ory.svc.cluster.local:4433"
- name: KRATOS_BROWSER_URL
value: "https://auth.DOMAIN_SUFFIX/kratos"
- name: HYDRA_ADMIN_URL
value: "http://hydra-admin.ory.svc.cluster.local:4445"
- name: PORT
value: "3000"
- name: COOKIE_SECRET
value: "localdev-cookie-secret"
- name: CSRF_COOKIE_NAME
value: "csrf"
- name: CSRF_COOKIE_SECRET
value: "localdev-csrf-secret"
resources:
limits:
memory: 64Mi
memory: 256Mi
requests:
memory: 32Mi
memory: 128Mi
cpu: 25m
---
apiVersion: v1

18
base/storage/seaweedfs-config.yaml
View File

@@ -15,8 +15,22 @@ data:
[s3]
enabled = true
port = 8333
# Credentials are loaded from the seaweedfs-s3-credentials Secret
# and passed as env vars (S3_ACCESS_KEY, S3_SECRET_KEY) to the filer.
s3.json: |
{
"identities": [
{
"name": "minioadmin",
"credentials": [
{
"accessKey": "minioadmin",
"secretKey": "minioadmin"
}
],
"actions": ["Admin", "Read", "Write", "List", "Tagging"]
}
]
}
master.toml: |
[master.maintenance]

1
base/storage/seaweedfs-filer.yaml
View File

@@ -21,6 +21,7 @@ spec:
- -port=8888
- -s3
- -s3.port=8333
- -s3.config=/etc/seaweedfs/s3.json
- -master=seaweedfs-master.storage.svc.cluster.local:9333
ports:
- name: http